CryptoES up to 2.0.x weak hash

Summaryinfo

A vulnerability has been found in CryptoES up to 2.0.x and classified as problematic. This affects an unknown part. The manipulation leads to weak hash. This vulnerability is referenced as CVE-2023-46133. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in CryptoES up to 2.0.x. It has been rated as problematic. This issue affects an unknown part. The manipulation with an unknown input leads to a weak hash vulnerability. Using CWE to declare the problem leads to CWE-328. The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack). Impacted is confidentiality. The summary by CVE is:

CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.

The weakness was published 10/26/2023 as GHSA-mpj8-q39x-wq5h. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2023-46133 since 10/16/2023. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1600.001 according to MITRE ATT&CK.

Upgrading to version 2.1.0 eliminates this vulnerability. Applying the patch d506677fae3d03a454b37ad126e0c119d416b757 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• CryptoES

Version

• 2.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion